In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()… (CVE-2026-98950)

The Linux kernel's bpf_flow_dissect() function sanitizes offsets using clamp_t(u16, ..., hlen). When hlen exceeds 65535, it is truncated due to the u16 type, causing offsets nhoff and thoff to be set to zero incorrectly. This truncation leads to improper handling of packet dissecting offsets in BPF flow dissectors. The vulnerability is analogous to a prior truncation bug fixed in the flow_dissector but was not covered in the BPF path. The resolution caps hlen at U16_MAX before clamping to prevent truncation errors.

Incorrect offset calculations in the BPF flow dissector could lead to improper packet processing within the kernel networking stack. While the exact exploitation impact is not detailed, such bugs can affect packet classification or filtering accuracy. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to cap hlen to U16_MAX before clamping in bpf_flow_dissect(). Users should update to the kernel version containing this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.